Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaintext HTTP in a Modern World

jcs.org

Post reply on HN
Print view View original

11–20 of 78 posts

Re: Plaintext HTTP in a Modern World

#11

Post by secondcoming »

nibbleshifter wrote: post #3

If you run older machines (I do) and want them to access the modern web, instead if asking everyone else to degrade their security - just run an upstream proxy that can fix the SSL issues for you. Its like an hours work to set up.

I agree. Having to support now-obsolete systems is a bane of software. HTTP itself sucks because there are so many standards-breaking systems out there. If you want to write a new custom HTTP server you need to understand all these potential quirks, reading the RFCs isn’t enough.

Re: Plaintext HTTP in a Modern World

#12

Post by shakna »

jbotdev wrote: post #6

Not sure I understand the concern about access from “modern embedded devices”. Something like a Raspberry Pi, or really anything with a decent ARM processor, can easily handle TLS.

TLS can be handled by much, much small devices, too! Most of the cheap Xtensa line of things, like the ESP can handle decoding TLS [0].

[0] https://docs.espressif.com/projects/esp-idf/en/latest/esp32/...

Re: Plaintext HTTP in a Modern World

#13

Post by oneplane »

This page doesn't seem to grasp the reasons behind using encrypted connections. It's not some 'security' blanket statement or 'have something to hide', it's tamper-prevention (including MITM malware injection), privacy, and a little bit of identity verification (not really something people do in the real world).

https://www.troyhunt.com/heres-why-your-static-website-needs...

If your problem is some ancient device that cannot speak reasonably recent protocols, the solution is to not allow that device on the main internet directly. That might mean the device itself has to live behind a proxy, or it has to use a remote browser, or it might (as you might guess) simply be a matter of decommissioning the device or only using it on a local network.

Any time the general security of a system is downgraded for some edge case, that same downgrade can be used to attack everyone else.

Re: Plaintext HTTP in a Modern World

#15

Post by Macha »

superkuh wrote: post #2

Everything in this article rings true. But there's more. HTTPS only, combined with almost everyone only using LetsEncrypt (a great service), leads to massive concentration of value for any internal corruption at LE or external political (or other) pressures on LE. The more browsers refuse to show HTTP, the more people in LE, the greater prize it is for those that want to control what is seen. If you want the web to b…

I believe there's three or four well accepted ACME providers now, which is why a lot of tools now support or even default to alternative vendors, partly to mitigate this concern. e.g. acme.sh will try ZeroSSL first, Caddy will rotate between ZeroSSL and Let's Encrypt.

Re: Plaintext HTTP in a Modern World

#16

Post by nine_k »

codepoet80 wrote: post #9

I love everything about this post, and the (short) discussion here. I worked out some complex PHP user-agent detection on my websites to serve HTTPS to newer machines, and HTTP to older ones. I instinctively knew Apache2/nginx should be able to do it, but all the documentation online is about redirecting everyone to HTTPS. I passionately believe older machines still have a place on the Internet, but everyone's in a h…

It's not just death of HTTP. It's the death of the "trust by default" model of Internet communication.

When the Internet didn't matter much, everything was in the open. Now that real money and real control critically depend on the Internet, everything is going to be encrypted, digitally signed, firewalled, etc.

I don't thunk there is a way back.

For old machines one can run a TLS-terminating proxy inside the secured internal network.

Re: Plaintext HTTP in a Modern World

#17

Post by chrismorgan »

Macha wrote: post #14

As an aside, if OP is the website owner: The font-size here is 10.5, it's really small and consequently hard to read.

Note that that’s 10.5pt, which is 14px, so it’s not so much smaller than 16px. Still smaller than advisable (I recommend 16–20px), but nowhere near as bad as 10.5px which is really tiny.

Re: Plaintext HTTP in a Modern World

#18

Post by shaicoleman »

oneplane wrote: post #13

This page doesn't seem to grasp the reasons behind using encrypted connections. It's not some 'security' blanket statement or 'have something to hide', it's tamper-prevention (including MITM malware injection), privacy, and a little bit of identity verification (not really something people do in the real world). https://www.troyhunt.com/heres-why-your-static-website-needs... If your problem is some ancient device tha…

Visiting a single unencrypted website allows anyone who controls the connection (your government/ISP/WiFi provider) to cause your browser to silently execute malicious code and download malicious content. Compromising the security of 99.9% of users for the benefit of the 0.1% isn't even remotely worth it. Those 0.1% also have a simple workaround of using a proxy if needed.

Re: Plaintext HTTP in a Modern World

#19

Post by bongobingo1 »

kgeist wrote: post #7

>While this push for security is good for protecting modern communication, there is a whole web full of information and services that don’t need to be secured It's not only about security. I wonder if it happens in other countries too - here in Russia ISPs used to inject advertisements directly into HTTP traffic which was very annoying and now they inject propaganda justifying the war. Fortunately very few sites use…

Comcast used to do this, Verizon too I think (as well as DNS hijacking).

Re: Plaintext HTTP in a Modern World

#20

Post by KronisLV »

superkuh wrote: post #2

Everything in this article rings true. But there's more. HTTPS only, combined with almost everyone only using LetsEncrypt (a great service), leads to massive concentration of value for any internal corruption at LE or external political (or other) pressures on LE. The more browsers refuse to show HTTP, the more people in LE, the greater prize it is for those that want to control what is seen. If you want the web to b…

> HTTPS only, combined with almost everyone only using LetsEncrypt (a great service), leads to massive concentration of value for any internal corruption at LE or external political (or other) pressures on LE.

Well where are all the other free SSL/TLS certificate providers, then?

ZeroSSL sometimes gets mentioned, though they are also pretty keen to charge you, which is the exact reason why many go for Let's Encrypt: https://zerossl.com/pricing/ (admittedly, they're much cheaper than most alternatives, but you can't beat free)

Most of the other paid providers out there do see like they're just running a racket in comparison:

  https://www.ssl.com/certificates/basicssl/
  https://www.digicert.com/tls-ssl/basic-tls-ssl-certificates
  https://www.godaddy.com/en-uk/web-security/ssl-certificate
It's an order of magnitude more expensive than just getting a domain, my expenses would be in the hundreds of dollars per year if I wanted to get the certificates from them, which I can't really afford while working in Latvia and having 30+ sites to manage across different domains.

Let's Encrypt works and once it stops working (should that ever happen, which you kind of need to include in your risk analysis), I'm kind of screwed.

Post reply on HN